2022/1/27 Japan Security Analyst Conference 2022

LuoYu: Continuous Espionage
Activities Targeting Japan with
the new version of WinDealer
in 2021
Leon Chang, Yusuke Niwa, Suguru Ishimaru

Speakers’ BioLeon Chang

Yusuke Niwa

Suguru Ishimaru

Malware Researcher@ TeamT5

Cybersecurity Researcher@ ITOCHU Corporation

Malware Researcher@ Kaspersky Lab

His major areas of research
include APT campaign
tracking, malware analysis.

He tracks threat trends
including malspam, APT,
and CyberCrime.

He conducts research of thelatest threat trends including
APT at a global level.

AGENDA01Summary of LuoYu campaign in 2021

02

Anatomy of WinDealer

03

Case Studies

04

Conclusions

AGENDA01

Summary of LuoYu campaign in 2021

02

Anatomy of WinDealer

03

Case Studies

04

Conclusions

Summary of LuoYu campaign in 2021◆

The LuoYu Threat Group Overview◆

Motivation: Why do we research LuoYu activity?

◆

Timeline of LuoYu campaign in 2021◆

Target regions and industries
Subsidiaries of Japanese organizations in China◆ The users of private Chinese bank◆

The LuoYu Threat Group Overview

The name: 蠃魚 (LuoYu)◆蠃魚(LuoYu) a Chinese mythological creature◆蠃魚，魚身而鳥翼，音如鴛鴦，見則其邑大水。

◆Translation: Fish with a pair of wings; When it
appears, floods always follow.

LuoYuTarget Industry

MalwareReverseWindow

WinDealerTechnology

SpyDealerMedia

Education

XDealer
ShadowPad

OriginPlugX

FinancialMOFA

New updates

Target Areas

Hong Kong

Telecom Logistics

New updates

China

China

MilitaryJapan

New updates
Korea

TaiwanRussiaUnited State Czech Republic

Australia

GermanyGoal
AttackCollecting informationfrom dissidents

Japan

AttackChinese branches ofJapanese company

Timeline of LuoYu Campaign in 2021

Timeline of LuoYu campaign in 2021
Case2

Case1
Identify new cross-platform
backdoor “XDealer”
Apr. 2021

Dropper of ReveseWindow& ShadowPad

The users ofprivate Chinese bankAug. 2021

Dec. 2021

May. 2021

Sep. 2021

Case3

Case4
Another Chinese branch ofJapanese company

Chinese branch ofJapanese company
Aug. 2021

The Linux variant of XDealer

AGENDA01

Summary of LuoYu campaign in 2021

02

Anatomy of WinDealer

03

Case Studies

04

Conclusions

Malware profile: WinDealer
Category

Description

Type

Modular backdoor

Namingstring prefix “Deal” in its export function

First seen2008

function

Getting victim label from non-exist URL or non-exist domain

C2Linked APT- C2 config- IP address generation algorithm (IPGA) NEWLuoYu

Hardcoded version of WinDealer
The hardcoded version of WinDealer probably comes from the built date.
◆ Version format: {Main_version}.{year}.{month+day}◆ We observed four versions from collected samples:◆

16.18.1030◆ 17.19.0505◆ 18.19.0628◆ 18.20.1225◆NEW

Hardcoded version of WinDealer
Before 2016, WinDealer used hardcoded development timestamp string asmutex string◆ We use the mutex string prefix to distinguish the backdoor version◆

WORK_20080729400351362402 → WinDealer 2008
◆ MANAGE_20130831175600761943 → WinDealer 2013
◆Evolution of WinDealer

Evolution of WinDealer

NEWWinDealer 2008

At first, the malware is designed to collect the sensitive data from
popular messaging application in China. (support 15 command)

WinDealer 2013

In 2013, it supported more spying function. (support 26 command)
The non-exist URL: "http://www.360.cn/status/getsign.asp"

WinDealer 16.18.1030

Since 2016, There’s hardcode version in WinDealer whichcontains the feature to steal shadowsocks profile.

WinDealer 17.19.0505

The non-exist URL was changed to "http://www.360.cn/status/getonefile.asp"

WinDealer 18.19.0628

The non-exist URL was changed to non-exist domain:
http://www.microsoftcom/status/getsign.asp, 48 command

WinDealer 18.20.1225

The latest version of WinDealer

In-Depth Analysis of WinDealer

In-Depth Analysis of WinDealer◆

Steganography Technique◆

Embedded DLL◆

Collecting host information◆

C2 communications◆

WinDealer Related Component

Steganography Technique◆

The malware contains an additional module in the resource “Bitmap”
using steganography technique to evade security products.
◆The encrypted DLL in res ID:129
Md5:76ba5272a17fdab7521ea21a57d23591

Decrypt the embedded DLL
Magic hex (4 bytes)

Size (4 bytes)

XOR Key (10 bytes)

Encryptedembedded
DLL

WinDealer EXE

Embedded DLL
XOR (10 bytes key)
AES (16 bytes key)

Encrypted BLOB

How to find BLOB and decrypt

The search method is to add 0x3000 bytes from the beginning of theimage, then advances 1 byte at a time and compares the magic hex
pattern to find the desired location.
◆ The embedded DLL is XORed using the 10 bytes key◆

The functionality of embedded DLL
Export function name

Description

partInitOpt

Mapping embedded functions on VFT for usingfrom main module as initialization

GetConfigInfo

Mapping embedded malware configuration datafrom the DLL

AutoGetSystemInfo

Creating many threads to get infected device
information

Generated victim ID set in a reg key

The victim ID format: MD5(“<MAC address><Physical_Drive_info><username>”)◆ The malware creates a specific registry key to store the generated victim ID to use
in the next execution.
◆ As a unique hidden trick, the victim ID is not stored raw data, the malware
converts the 4 bytes victim ID to an IP address style.
◆Collecting host information
Computer name
◆ Username◆ CPU info
◆ OS version◆ Network interface◆ External IP address◆ User account◆ Screenshots◆

C2 communications◆

Before sending the victim data, the malware will add a custom header to thedata◆

Interesting features:◆

Getting victim label from non-exist domain or non-exist URL based on WinDealer version
http://www.360[.]cn/status/getsign.asp◆ http://www.360[.]cn/status/getonefile.asp◆ NXDOMAIN: http://www[.]microsoftcom/status/getsign.asp
NEW
◆

◆

C2 anti-tracking mechanism◆

IP address generation algorithm (IPGA) NEW

Getting victim label from NXDOMAIN

C2 anti-tracking mechanism

Use IPGA (IP Generation Algorithm) to generate a random C2 IP addresswhen backdoor does not have C2 config◆ The randomly generated IP will exist within specific IP address ranges◆◆◆

Ex: 113.62.0.0 - 113.63.255.255 or 111.120.0.0 - 111.123.255.255

This mechanism will prevent researchers from tracking down the real C2 IPC2 communications

Custom header

RSA encrypted

Generated AES KeyTCP/UDP socket

WinDealer

Custom header

AES encrypted
TCP/UDP socket

Victim data

C2 Server

Data format of c2 communications (first connection)
OffsetDescription

Example(hex)0x00

Magic header

06 81 DA 91 CE C7 9F 430x08

Generated Victim ID

0x0C

Victim label

00 or 01 or 020x0D

Connection type or
Backdoor command ID

00 = initial connection
01 = after initial connection
Others = backdoor command ID

0x0E

Unknown static value

11 or 140x0F

Unknown static value

000x10Encrypted data + checksum

Generate 16 bytes AES key toencrypt C2 communication

Sending AES key crypted RSA

C2 communication encrypted by AES

1 byte command in custom header+0xD

Divided backdoor in EXE and Embedded DLLWinDealer Related Component◆

We have found the downloader of WinDealer in the wild since 2013.

◆

In addition, we found old Windows kernel module downloader (2015 ~ 2017)◆PDB string: “Z:¥O¥植入相关¥本地溢出¥downexecdriver¥bin¥FAT32.pdb”

WinDealer Related Component◆◆We discovered a WinDealer downloader which contains a legitimate domain but the URL pathis non-existing. (DNS hijacking or network hijacking)User-agent is an unique "BBB," which also appears in WinDealer RATWinDealer
WinDealer downloader + Legitimate URLWinDealer Related Component◆◆◆

There’re multiple dropper/loader samples related to WinDealer.
The malware resource “AAA” contains an encrypted payload◆ The encrypted payload in res ID:103
Ex. The malware uses XOR to decrypt the payload, then loads the decrypted payload(WinDealer) in-memory.

decrypt and load
WinDealer

AGENDA01

Summary of LuoYu campaign in 2021

02

Anatomy of WinDealer

03

Case Studies

04

Conclusions

Case Study 1: Fake site and app◆

Phishing site and trojanized installer impersonate private Chinese online
banking app

Download
Phishing site
(mirrored the bank’slegitimate webpage)

Connect
Trojanized installerof the banking app

ReverseWindow(Windows, Android)

C2 Server

Case Study 2: Drop error image for distraction
Drop & Execute

ReverseWindow
version: 2.2.2006131

Connect
C2 Server

Drop & Execute
The dropper ofReverseWindow(.error.exe)

Delete dropper

Drop &Open Directory

Bash Script(C:¥ProgramData¥u.bat)

Decoy(.¥Error.jpg)

Deceive &Distract

Case Study 2:
Combine use of both proprietary and shared backdoors◆Recently, We found that LuoYu is using Shadowpad to attack unknown targets

ReverseWindow
version: 2.2.2006131

C2 ServerUnknown
targetShadowPad
latest obfuscation method (code scattering)Case Study 3
Ver. 18.20.1225
TIM.exe

WinDealer(qbupd.exe)

Victim HostLuoYu

TIM ( a legitimate communication tool) tried to download the WinDealer, qbupd.exe
somehow even though accessing a legitimate destination of updater.
C:¥Users¥<UserName>¥AppData¥Roaming¥Microsoft¥Windows¥Start Menu¥Programs¥Startup¥qbupd.exe
After created WinDealer on the startup folder, once victim user logged in this host,WinDealer is executed and sends stolen data over 6999/UDP to backbone router.

Case Study 4Ver. 18.19.0628
YoudaoDict.exe

Victim Host

WinDealer(version.dll)

LuoYu

YoudaoDict(legitimate tool) tried to download the WinDealer, version.dll, then dllsideloading it and executed embedded dll at the end of June 2021.
AV has detected this version’s WinDealer several times though, due to thereplacement of AV in this organization, the victim host resulted in compromised.

Public info research (Chinese BBS )Chinese blog post from Feb 2019 describes a WinDealer-related infection and involving an executablewith the same file name (pptv(pplive)_forap_1084_9993.exe) which we’ve observed.

Details of Infection flow

◆Legitimate EXE
downloads aWinDealer in thespecific conditions.

WinDealer’s Initial Vector & Communication Flow
LegitimateApps

InitialVectorLegitimate Update Server

Backbone Router(CN)Victim Hostwith a legitimate tool
And its updater

WinDealer or Dropper
Step1: query a non-exist domain for labeling victims
Step2: send victim data to backbone router by IPGA

Malware hosted Server

Invisible Area
Post
Infected victim hostwith WinDealer

・・・

Exploitation

LuoYu‘s C2

Backbone Router(CN)LuoYu

AGENDA01

Summary of LuoYu campaign in 2021

02

Anatomy of WinDealer

03

Case Studies

04

Conclusions

LuoYu campaign in 2021
ADVERSARYCAPABILITY◆

SIGINT Technique (N/A)
Manipulating a legitimate softwareUpdate mechanism
Leverage IPGA
Usage of DLL-Sideloading
Send stolen data with UDP protocol◆
◆◆◆
◆◆

◆

LuoYu: Chinese-speaking actor
Possible collaboration with the other Chinese APTgroup

INFRASTRUCTURE◆

TARGET◆◆

Target area: Wide range, mainly East Asia
(including Chinese branches of Japanese companies)
Target industries: Wide range

CHINANET-BACKBONE
113.62.0.0/15 or 111.120.0.0/14(random IP addresses)

LuoYu’s TTPs
MITRE ATT&CK Mapping
TacticsTechniques
Trusted Relationship:
Leverage SIGINT to tamper with traffic at the ISP levelInitial Access

T1199

Execution

T1059.003

Command and Scripting Interpreter: Windows Command Shell
WinDealer creates a pipe with cmd.exe

T1547.001

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
WinDealer sets a value in the registry“HKEY_CURRENT_USER¥Software¥Microsoft¥Windows¥Currentversion¥Run” forstartup.
WinDealer has been created on startup folder below.
C:¥Users¥<UserName>¥AppData¥Roaming¥Microsoft¥Windows¥Start
Menu¥Programs¥Startup¥qbupd.exe

Persistence

DefenseEvasionT1027.002

T1574.002

Obfuscated Files or Information: Software Packing
WinDealer’s functions are divided between the EXE and DLL. The DLL is implemented inits own resource with encryption. Hardcoded strings / data are obfuscated in some
WinDealer samples. Gathered data is XORed using a one-byte key “Y”.
Hijack Execution Flow: DLL Side-Loading:
WinDealer is executed DLL Side-loading by legitimate PE files

LuoYu’s TTPs
MITRE ATT&CK Mapping
TacticsTechniques
T1012

Query Registry:
WinDealer lists installed applications and stores configuration information in the registry.

T1016

System Network Configuration Discovery:
WinDealer lists networks adapters and their addresses

T1016.001

Discovery

System Network Configuration Discovery: Internet Connection Discovery
WinDealer gets the public IP via “http://icanhazip.com/”.

T1049

System Network Connections Discovery:
WinDealer scans the hosts in the LAN using ICMP.

T1057

Process Discovery: WinDealer gets the process list.

T1082

System Information Discovery: WinDealer gets hostname, CPU info, OS version, mac address
and username. The backdoor command 0xD obtains the keyboard layout.

T1083

File and Directory Discovery: WinDealer gets a file list and metadata of specified files.

T1120

Peripheral Device Discovery:
WinDealer gets system disk information and USB drive information.

T1518

Software Discovery: WinDealer lists installed applications, WinDealer gets configuration filesof chat applications such as Skype, QQ, WeChat and wangwang.

LuoYu’s TTPs
MITRE ATT&CK Mapping
Tactics
Collection

Commandand Control

Exfiltration

Techniques
T1113

Screen Capture: WinDealer can take screen captures.

T1568

Dynamic Resolution: WinDealer dynamically generates C2 IP using IPGA.

T1573.001

Encrypted Channel: Symmetric Cryptography
Further communications are encrypted by AES-128 in ECB mode.

T1573.002

Encrypted Channel: Asymmetric Cryptography
WinDealer uses RSA-2048 during its key exchange phase.

T1041

Exfiltration Over C2 Channel:
WinDealer exfiltrates the gathered data over C2 channels.

Countermeasures against this campaign◆

◆

◆

◆

Cyber Hygiene Matters!
◆ Check before clicking links and downloading files
While preventing malware downloads with SIGINT is very difficult,detecting and dealing with them is relatively easy.

Deployment of AV and continuous its alert monitoring
Firewall implicit denial setting, and in the case of WFH, Windows
Firewall setting is recommended on the host side as well.

Conclusions◆◆◆

LuoYu is increasing its attack scope to companies and users in East
Asia, including Japan (and their branches in China).
Notable TTPs
◆ Arsenals having capabilities to attack multiple platforms◆ Utilization of popular shared tools (i.e., ShadowPad, PlugX)◆ Various attack vector such as SIGINT, watering hole attacks, etc.
LuoYu’s evolution throughout 2021 indicates its potential indeveloping into a more sophisticated group in the futureReference◆https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf◆

https://www.fortinet.com/blog/threat-research/chinese-targeted-trojan-analysis◆

https://blogs.jpcert.or.jp/ja/2021/10/windealer.html◆

https://www.shuzhiduo.com/A/8Bz8k3Pxdx/◆

https://bbs.kafan.cn/thread-2157062-1-1.html

IoCs
No

VersionFile Name

1

18.19.0628

version.dll

6102f77c85541d00b4c3bc95f100febc

2

18.20.1225

qbupd.exe

D9A6725B6A2B38F96974518EC9E361AB

18.20.1225

NewsClientPlugin.exe

76ba5272a17fdab7521ea21a57d23591

18.20.1225

RuntimeBroker.exe

cc7207f09a6fe41c71626ad4d3f127ce

3

Malware Type

WinDealer

4C2
WinDealer

MD5

Domain/IP

Remarks

113.62.0.0/15 111.120.0.0/14

Using 55556/TCP, 6999/UDP

221.195.68.71/32
122.112.245.55/32

THANK YOU!
Any Questions?